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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by 
the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector General 
Act of 1978. This is one of a series of audit, inspection, and special reports published by our office 
as part of our oversight responsibility to promote economy, efficiency, and effectiveness within the 
department. 

This report is the second of a series of OIG performance audit reports intended to provide an 
assessment of planned DHS corrective actions to improve internal control. Improving internal 
control is a critical objective of the DHS Financial Accountability Act (Public Law 108-330). The 
report is based on interviews with employees and officials of relevant agencies and institutions, 
direct observations, and a review of applicable documents. We contracted with the independent 
public accounting firm KPMG LLP to perform the audit. KPMG is responsible for the attached 
auditor's report and the conclusions expressed in it. 

The recommendations herein have been discussed in draft with those responsible for 
implementation. It is our hope that this report will result in more effective, efficient, and economical 
operations. We express our appreciation to all of those who contributed to the preparation of this 



report. 




Richard L. Skinner 
Inspector General 



KPMG LLP 

2001 M Street, NW 
Washington, DC 20036 
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KPMG is pleased to submit this performance audit report related to the Department of Homeland 
Security's (the Department's) corrective action plans developed to address the Financial 
Management Oversight, Financial Reporting, Fund Balance with Treasury, and Actuarial Liabilities 
material weaknesses at the Office of the Chief Financial Officer, United States Coast Guard, and 
Immigration and Customs Enforcement components as reported in the Department's independent 
auditors' report in the FY 2005 Performance and Accountability Report. This performance audit is 
the second of a series of performance audits that the Department of Homeland Security Office of 
Inspector General has engaged us to perform for fiscal year 2006. This performance audit is 
designed to meet the objectives identified in the Background, Objectives, and Scope section of this 
report. 

We conducted our second performance audit from June 12, 2006 through July 7, 2006, in 
accordance with Government Auditing Standards issued by the Comptroller General of the United 
States. The purpose of this report is to communicate the results of our performance audit and the 
related findings and recommendations. Management concurred with our recommendations and 
prepared a response which is presented at the end of this report. 

Since July 7, 2006, we have not performed any additional procedures with respect to this 
performance audit and have no obligation to update this report or to revise the information 
contained herein to reflect events occurring subsequent to July 7,2006. 

The Department of Homeland Security Office of Inspector General has authorized this report to be 
sent electronically for the convenience of the Department. However, only the final hard-copy report 
should be deemed our work product. 
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Executive Summary 



Overall, the Department of Homeland Security (the Department) is working to identify and develop 
effective Corrective Action Plans (CAPs) to address the four material weaknesses at the Office of 
the Chief Financial Officer (OCFO), United States Coast Guard (Coast Guard), and Immigration 
and Customs Enforcement (ICE) over Financial Management Oversight, Financial Reporting, Fund 
Balance with Treasury, and Actuarial Liabilities (herein referred to as the "material weaknesses"), 
as reported in the Department's independent auditors' report included in the FY 2005 Performance 
and Accountability Report (herein referred to as the "FY 2005 independent auditors' report"). The 
OCFO, Coast Guard, and ICE have drafted CAPs intended to address their respective sections of the 
material weaknesses. The Department deems these CAPs as critical steps towards its objective of 
obtaining an unqualified audit opinion on its consolidated financial statements, as well as on its 
internal controls over financial reporting. Our performance audit was limited to a review of the 
CAPs themselves and not the outcomes achieved as a result of the execution of the procedures 
outlined in the CAPs. 



Findings and Recommendations 

KPMG identified several opportunities for management's consideration to improve the 
effectiveness of the Department's CAPs. KPMG has classified each of these observations into one 
of the following four broad categories representing phases which are generally performed to 
develop and implement an effective CAP: 

• Identification of the underlying root cause, 

• Development of an effective remediation plan, 

• Accountability for establishment and successful implementation of the CAP, and 

• Validation of the successful implementation of the CAP. 

The recommendations needed, which we identified in relation to the CAPs for these material 
weaknesses, vary depending on the component, and in some cases on the material weakness itself. 



Background, Objectives, and Scope 
Background 

Office of Management and Budget (OMB) Circular A- 123, Management's Responsibility for 
Internal Control, states "Federal agencies are subject to numerous legislative and regulatory 
requirements that promote and support effective internal control. Effective internal control is a key 
factor in achieving agency missions and program results through improved accountability. 
Identifying internal control weaknesses and taking related corrective actions are critically important 
to creating and maintaining a strong internal control infrastructure that supports the achievement of 
agency objectives." 

OMB Circular A- 123 builds upon the internal control framework within the Standards for Internal 
Control in the Federal Government (Green Book), issued by the Government Accountability Office 
(GAO), which defines internal control as "an integral component of an organization's management 
that provides reasonable assurance that the following objectives are being achieved: 

• effectiveness and efficiency of operations, 

• reliability of financial reporting, and 

• compliance with applicable laws and regulations." 

Ten material weaknesses associated with internal controls were reported in the Department's 
independent auditors' report included in the FY 2005 Performance and Accountability Report. The 
Department has undertaken an initiative to develop and implement a formal corrective action plan 
process. Under this initiative, the Department issued various guidance and also deployed a web- 
based software application, Electronic Prog ram Management Office (ePMO), to manage the 
collection and reporting of CAP information for the Department and its components. Under this 
initiative, the Department's intent is to develop effective CAPs and position itself to move forward 
in its objective of obtaining an unqualified audit opinion on its consolidated financial statements, as 
well as on its internal controls over financial reporting. 

The first key milestone in the Department's CAP process was May 31, 2006, whereby all 
components were required to develop CAPs for each material weakness under the new format for 
input into ePMO by the Department's OCFO. The second key milestone will be the submission of 
revised CAPs as of June 30,2006, by July 12,2006. The revised CAPs are outside the scope of this 
performance audit. 

Objectives 

The objective of this performance audit is to report and evaluate the status and effectiveness of the 
CAPs for four of the ten material weaknesses that the Department has identified as their areas of 
CAP focus for FY 2006. The four material weaknesses are: Financial Management Oversight, 
Financial Reporting, Fund Balance with Treasury, and Actuarial Liabilities. Our audit was 
conducted in accordance with Government Auditing Standards issued by the Comptroller General 
of the United States, specifically, the standards for performance audits. 

Our objective is to report on the status of CAP implementation, as of May 3 1 , 2006, and evaluate 
the effectiveness of the Department's CAPs developed by the OCFO, Coast Guard, and ICE to 
address their respective sections of the four material weaknesses. 



Scope 



The scope of this performance audit includes the Department's CAPs, as of May 31, 2006, 
developed to address the Financial Management Oversight, Financial Reporting, Fund Balance with 
Treasury, and Actuarial Liabilities material weaknesses at the OCFO, Coast Guard, and ICE 
components as reported in the FY 2005 independent auditors' report. Our scope did not include 
procedures on any of the CAPs associated with the remaining six material weaknesses cited in the 
Department's FY 2005 independent auditors' report. 

The Department is in the early stages of its CAP development and implementation process, and 
accordingly, management has represented that its CAPs will continue to be modified throughout the 
year. Our performance audit was limited to a review of the CAPs noted above as of May 31, 2006. 
Revised CAPs as of June 30,2006, due by July 12, 2006, to the OCFO are outside the scope of this 
performance audit. Furthermore, our performance audit was limited to a review of the CAPs 
themselves and not the outcome being achieved as a result of the procedures outlined in the CAPs. 

The timeline for this performance audit was as follows: 

• Fieldwork/Reporting - June 12,2006 through July 7,2006 

• Draft Report - July 1 7,2006 

• Final Report - September 6,2006 

Performance Audit Approach 

We performed a variety of performance audit procedures over the CAPs for the four material 
weaknesses. Our methodology consisted of the following four-phased approach: 

Phase I - Project Initiation and Planning 

To initiate and focus the performance audit approach, we conducted a kick-off meeting with the 
Department's OIG, OCFO, Coast Guard, and ICE components to review the objectives, scope of the 
project, and the collaboration among participants. 

Phase II - Determine the CAP Status of the Four Material Weaknesses 

• OCFO, Coast Guard and ICE Interviews 

We interviewed personnel from the OCFO, Coast Guard and ICE components on their 
understanding and implementation of their respective components' CAPs as of May 3 1 , 2006, 
including, but not limited to, the root cause analysis performed, the critical milestones chosen 
for measurement, and mechanisms to monitor progress in meeting the milestones. 

• CAPs and Related Supporting Documentation Reviews 

The CAPs (i.e., the detail and summary report) contained within ePMO. 

The underlying Excel and Word templates submitted to the Department's OCFO to 
populate ePMO. 

If applicable, the CAPs prepared prior to the implementation of the Department's fiscal 
year 2006 CAP process (i.e. ICE Financial Action Plans (FAPS)). 



Notice of Findings and Recommendations (NFRs) issued during the fiscal year 2005 
financial statement audit utilized to generate the FY 2005 independent auditors' report. 

Phase III - Evaluate CAP Effectiveness 

We reviewed the DHS Corrective Action Plan Process Guide (CAP Guide), dated April 28, 2006, 
and existing internal control monitoring practices and guidance for practices that would serve as our 
evaluation criteria. We then compared our understanding of the Department's existing CAPs to 
these practices to identify potential areas for improvement. These findings reflect situations that 
could negatively impact the Department's remediation of the material weaknesses if additional 
corrective action is not taken. 

The internal control monitoring practices and guidance we reviewed included: 

• OMB Circular A- 123. 

• CAP guides published by other Federal agencies. 

• OMB Executive Branch Management Scorecard. 

We categorized the areas for improvement into one of the four broad phases generally found in an 
effective CAP process: 

• Identification of the underlying root cause is an important action step in the CAP process. 
Accurate identification of the root cause mitigates the chances of recurrence. Often merely the 
symptoms of the deficiency are identified rather than the root cause. By identifying only the 
symptoms, it is difficult to develop an effective CAP that will successfully resolve the 
deficiency. 

• Development of an effective remediation plan is an appropriate way to cure an internal control 
deficiency. A key component of an effective plan is the inclusion of both attainable and 
measurable milestones to allow both the Department and the component to effectively monitor 
the remediation process. 

• Accountability is vital to the CAP process because it necessitates the establishment of an 
individual CAP owner who is responsible for its successful implementation. The owner's 
responsibilities include ensuring that milestones are achieved and that the validation phase is 
completed. 

• Validation is important in order to verify that the CAP has been successfully completed. The 
CAP should include activities that will provide evidence to support the closure of the CAP. 
These activities should include documentation reviews, work observations, and performance 
testing. 



Phase IV - Conclusions and Recommendations 

After conducting our analysis in Phase III, we formulated our findings and recommendations for 
each potential area of improvement identified. 



Findings and Recommendations 
Office of the Chief Financial Officer (OCFO) 

The OCFO has drafted CAPs intended to address its respective sections of the two material 
weaknesses on Financial Management Oversight and Financial Reporting reported in the FY 2005 
independent auditors' report. 

Financial Management Oversight 

Background: 

The Financial Management Oversight material weakness relates to the overall management, 
personnel, and infrastructure of the OCFO. The OCFO initiated the Department- wide CAP process 
in early 2006. A crucial step in remediation of this material weakness was the successful 
confirmation by the U.S. Senate of the Department's Chief Financial Officer in May 2006. As part 
of the CAP process, the OCFO has led the Department in drafting guidance and providing the DHS 
components with tools to utilize during their respective CAP implementations. The OCFO has led 
'CAP Workshops' with representatives from the Department components so that an adequate, 
uniform approach to performing root cause analyses and implementing corrective actions is taken 
Department-wide. The OCFO also developed the Electronic Program Management Office (ePMO) 
system enabling the Department and the components to track the corrective actions being 
undertaken at the component level to ensure a coordinated Department- wide response to auditor 
findings and recommendations. The OCFO has issued a CAP Guide and is currently in the 
developmental stages of creating an Internal Controls over Financial Reporting (ICOFR) Playbook 
for the components. Furthermore, these actions reflect the OCFO's recognition that the CAP 
process at DHS is an integral part of its preparation for OMB A- 123 implementation. 

The leadership provided by the Department in setting a positive 'tone-at-the-top,' and actively 
monitoring progress in implementing the CAP process has shown to be integral to the success 
achieved at the Department thus far and will be critical to resolving the material weaknesses at the 
Department. 

Identification: 

The OCFO has drafted a CAP to address the material weakness on Financial Management 
Oversight, as it relates to the OCFO. The CAP includes an analysis of root cause issues, key success 
factors and performance measures, resources required, and an analysis of the risks and impediments 
as seen by management. In addition, management has developed a timetable for corrective actions, 
and assigned specific tasks with due dates to individuals. Management emphasizes the evolutionary 
nature of the CAP, including their intent to modify and/or add actions as needed to fully correct the 
identified internal control weaknesses in financial management oversight, within the timetable 
specified by Department leadership (September 30, 2006). As the work progresses, management 
may identify additional root causes and will update the CAP accordingly in order to keep the CAP 
current and a useful management plan. 

One of the key inputs used by the Department in the development of the OCFO CAP addressing the 
Financial Management Oversight internal control weaknesses was a self assessment using the GAO 
Internal Control Management and Evaluation Tool (GAO Evaluation Tool). Completion of a self 
assessment using the GAO Evaluation Tool was a Departmental mandate to support compliance 
with the Department of Homeland Security Financial Accountability Act, the Federal Managers ' 
Financial Integrity Act (FMFIA), and implementation of OMB Circular A-123, Management's 
Responsibility for Internal Controls in FY 2006. 



The OCFO, under the direction of the Acting Chief Financial Officer (CFO), began its self 
assessment of its control environment in FY 2006, and completed a thorough introspective review 
over several months. Department management views the control environment as the foundation for 
good financial management. 

The GAO Evaluation Tool is intended to help managers determine how well the Department's 
control environment is designed and functioning and to help identify and develop actions to 
improve internal controls. Many of the financial management oversight weaknesses, as highlighted 
in the FY 2005 independent auditors' report, are synonymous with weaknesses in the overall control 
environment, and consequently, the GAO Evaluation Tool provided a starting point for 
identification and analysis of the root causes of the weakness. 

The OCFO concluded that only two of the seven control environment objectives from the GAO 
Evaluation Tool are fully met by the Department. Commitment to competence, management 
philosophy, organizational structure, assignment of responsibilities and human resource practices 
are aspects of the control environment that require improvement. This self-assessment served as the 
Department's principle source of information to identify the root cause of the OCFO's contribution 
to the material weakness on financial management oversight and as input to the CAP. By itself, 
however, completion of the GAO Evaluation Tool does not substitute for a comprehensive root 
cause analysis. 

Development: 

Using the information gathered through the self-assessment, the OCFO prepared its CAP to address 
weaknesses in the control environment. The CAP is in the early stages of development and 
approval, yet several significant steps have already been taken. One such step is the drafting and 
release of the CAP Guide, and a formal process of reporting and monitoring (using ePMO) of 
corrective actions planned by the Department and its components. Another recent action is 
management's approval to initiate a workforce study to identify human resource gaps and skill sets 
needed to perform the financial reporting functions of the OCFO. 

The initial draft of the CAP, based on the results of the self assessment of the control environment, 
including the assigned tasks and timetable for completion, was recently completed - within the past 
45 days. Management will require more time to fully develop all of the corrective tasks and critical 
milestones; specifically, further developing certain missing elements (described below), to make the 
plan comprehensive. Until management addresses the missing elements, the effectiveness of the 
CAP is diminished. 

The OCFO also sponsors periodic "CAP Workshops" attended by the Department's components, to 
help ensure continued progress is made in regards to CAPs throughout the Department. In addition, 
the OCFO is developing an Internal Control Over Financial Reporting (ICOFR) Playbook which, 
when completed, is intended to link the component CAPs to management's implementation of 
OMB A- 123 and ultimately with management's assertions related to internal controls over financial 
reporting. 

The OCFO presented us with several updates, not yet incorporated into the CAP, that are currently 
under development and review by Department leadership, which partially address some of our 
findings presented below: 

• The Department has a limited number of employees, with necessary skill sets, particularly in 
OCFO financial management positions, which causes the current managers to prioritize 
workload, and postpone or defer work on critical projects such as policies, procedures, internal 
control improvements, etc. As a result, management has hired three full-time employees in 
fiscal year 2006 and has budgeted for an additional 13 full time equivalents over the next two 



years. In addition, management has identified the need for an organizational staffing and 
human resource needs study. A summary level document of the objectives for such a study has 
been prepared and approval for further development and engagement of a contractor to perform 
the study was recently obtained from the Department's Deputy CFO. Management, however, 
has not yet fully developed and documented a detailed approach to the organizational needs 
assessment in the CAP, or prepared a Statement of Work, or engaged a contractor with the 
necessary expertise. 

• The Department must overcome organizational structure issues that may impede the 
effectiveness of the Department's CFO and those in the OCFO for two primary reasons: (1) 
since its inception, the Department has operated under a matrix management philosophy 
/structure, with Chief (e.g., CFO, Chief Information Officer, Chief Procurement Officer, etc..) 
management and administrative responsibilities that cross-cut component operation at a 
Department level. Historically, the Department's CFO has seldom exercised his authority to 
implement policy and procedures, including, and most importantly, financial reporting controls 
across the Department. 

• The CAP does not include a review of position descriptions for all current OCFO management 
and staff, to identify corrective actions necessary to better align job responsibilities with 
available human resources. In addition, the CAP does not address the linkage of annual goal 
setting and performance appraisals for managers and staff in the OCFO with specific OCFO 
objectives, e.g., implementation of CAPs, improvement in internal controls, etc. 

• The Department has identified the need for an additional senior management official in the area 
of financial management,, however, a CAP has not been developed to include steps to actively 
recruit for this position (e.g., posting the job announcement or advertising / interviewing for the 
position). 

• The CAP lacks procedures to identify weaknesses in management and staff training 
requirements. For example, the training programs attended by managers and staff have not been 
identified based on a critical needs and core competency assessment of training programs to 
improve essential skills. 

• Clear internal reporting relationships within the Department have not been established, defining 
OCFO and component responsibilities for CAP development and implementation especially in 
areas of overlap. 

Accountability: 

Until the matters mentioned above are fully developed and addressed, key areas of authority and 
responsibility for the CAP implementation cannot be adequately defined and communicated 
throughout the Department, especially as they relate to the interaction between the OCFO and 
component financial and reporting operations. The assignment of accountability for improvements 
has occurred, but due to the pace of CAP development the improvements brought about by the 
assignment have yet to take full effect. 



Financial Reporting 

Background: 

The Financial Reporting material weakness is focused specifically on the reliability and timeliness 
of the interim and year-end consolidated financial statements. The OCFO, and in particular the 
financial reporting functions, have undergone substantial change in FY 2006, due to staff turnover, 
restructuring of the office, and a reallocation of roles and responsibilities. The OCFO lost one key 
manager to an internal transfer in FY 2006. The office was restructured into four functional areas 
each lead by a Director - Financial Reporting, Financial Systems and Administration, Policy, and 
Internal Control. Three staff personnel have been hired to fill vacancies identified at the beginning 
of the year, which has helped with the distribution of workload. However, some accounting 
personnel vacancies still remain, and management asserts that at least one key managerial position 
remains unfilled. To supplement expertise and distribute workload, the OCFO has hired an outside 
contractor to assist with the preparation of periodic financial statements and the FY 2006 
Performance and Accountability Report, and performance of CAPs. The Policy branch is in the 
very early stages of development, e.g., has a target date of August 2006, for issuance of its own 
Charter and assignments to working group members. 

Identification: 

Upon review of the financial reporting CAP, we observed an analysis of root cause issues, key 
success factors and performance measures, resources required, and an analysis of the risks and 
impediments as seen by management. However, as explained below, the CAP is a mixture of typical 
financial reporting roles and responsibilities and corrective actions. It is not clearly written to focus 
on the information necessary to identify root causes, detailed listings of task, and assignments of 
responsibility that will ultimately lead to the correction of the Financial Reporting material 
weakness. The CAP is designed to accommodate periodic updates/modifications as necessary to 
keep the CAP current and a useful management plan. As the work progresses, management may 
identify additional root causes and will update accordingly. 

Management's root cause analysis, conducted in FY 2006, shows that many of the conditions 
identified and reported by the independent auditor stem from challenges associated with the set-up 
of a new Federal department. Staffing decisions, allocation of limited resources, the need for new 
policies and procedures, internal controls, integration of financial processes and systems, to name a 
few conditions noted in the FY 2005 independent auditors' report, are typically multi-year projects 
to set-up organizations the size of the Department. 

Development: 

When the OCFO completes its identification of the underlying root causes of the financial reporting 
weakness, including management's response to the findings noted above, CAPs will need to be 
developed and implemented, together with specific milestones and assignment tasks and oversight 
to individuals. 

The development and implementation of the CAP tasks have not been coordinated with the CAPs 
from the other Department components or with the Department's OMB Circular A-123 
implementation - two closely related aspects of financial reporting and internal control 
improvements. 

Since the CAP was only recently drafted and management has not had enough time to fully and 
completely identify and develop the CAP tasks, we noted several critical elements missing from the 
CAP that should be considered for inclusion. Without the addition of the critical missing elements 
(described below), the plan is not comprehensive, which could diminish the ultimate effectiveness 



of the CAP. In some cases, the OCFO was able to demonstrate that the missing elements are 
dependent on the outcome of the Financial Management Oversight CAP, e.g., organizational and 
workforce study, and consequently there is a natural lag in the identification and development of the 
Financial Reporting CAP. The critical missing elements are as follows: 

• The list of critical milestones and detailed tasks in the CAP are not comprehensive, and do not 
clearly show linkage to the weaknesses being corrected or the root cause issues. For example, 
management's root cause analysis indicates that OFM roles and responsibilities are not clearly 
defined, including insufficient back-up role planning. It is not clear which, if any, of the detailed 
tasks will address this issue. 

• Many of the tasks listed in the CAP appear to be ordinary, routine responsibilities of the OCFO, 
rather than tasks meant to investigate and correct the root cause issues (i.e., "compile a hard- 
close June 30, 2006 PAR Section 3," "compile MD&A Section of the PAR," and to "compile 
September 30 financial statements"). All of these tasks are normal operational responsibilities 
of the OCFO and are not corrective actions. In addition, a disproportionate number of tasks 
appear to be administrative tasks that are not substantial actions to correct issues (i.e., "establish 
Department FMPIP subcommittee of working groups to evaluate policy and directives (an 
action with a due date of June 15, 2006, and labeled as "not started")). 

• The CAP lacks procedures to identify the root cause underlying the reason why polices and 
procedures require excessive time to develop, approve and issue. In some cases, draft OCFO 
policies have been pending approval for more than a year - with no clear time-line for 
management approval and issuance. Despite the establishment of a Policy branch, no policies 
and procedures (by official Management Directive) have been issued in FY 2006. Policy 
issuance has been hindered by limited resources and a lack of coordination between the 
Department's operating components. For example, seven policies are in process but all have 
stalled or been held up from issuance, in some cases for more than a year. 

Accountability: 

We observed that the OCFO has hired a reputable outside contractor to assist with financial 
reporting functions and CAP related tasks, as needed. However, as of May 31, 2006, the contractor 
hired to support the OCFO is limited to only two full-time professionals, and consequently, is 
dedicated to important, but narrowly focused, periodic financial reporting roles. 

Implementation of the financial reporting CAP has been divided among several OCFO managers 
who do not have sufficient time to commit to the project, and therefore must delegate most of the 
tasks. Accountability for the financial reporting CAP is not clearly defined or tracked. Further, the 
financial reporting CAP is not managed or monitored by a senior executive, and other priorities of 
the OCFO have slowed progress. These conditions appear to have slowed progress - only 9 of the 
55 tasks are shown as complete (many of which are routine operations or administrative functions 
as mentioned above). 

Recommendations 

OCFO - Financial Management Oversight 

We recommend that: 

1. Corrective actions be added to the CAP to identify weaknesses in management and staff 
training policies, and to then develop and document corrective actions in the CAP. 
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2. Management should engage an outside independent contractor that specializes in this subject 
matter to perform its recently approved organizational workforce and human resource needs 
study. When the study is complete, CAPs will need to be developed and implemented, together 
with specific milestones and assignment of tasks and accountability to individuals. The study 
should provide management with: 

• A critical assessment of the knowledge, skills, and abilities needed to perform the functions 
of the OCFO, and identify technical and experience gaps, so that recruiting, hiring, training 
and role definition can be adjusted if necessary; and 

• A review of position descriptions for all current OCFO management and staff, to identify 
corrective actions necessary to better align job responsibilities with skill sets and available 
human resources, and to clarify reporting responsibilities that overlap within the OCFO, and 
to make recommendations to better align annual goal setting and performance appraisals 
with OCFO objectives. 

3. The agency continue its recruitment of an additional senior manager who has extensive 
experience with department level consolidated financial reporting, to serve in a senior 
management position in the area of financial management (i.e., posting or advertising the job 
announcement, interviewing and hiring for the position). 

4. Define the exact criteria which will be used to ascertain when the corrective action has been 
successfully completed, as well as the method for testing against such criteria as part of OMB 
A- 123 implementation steps (i.e. tests of design and tests of operating effectiveness of internal 
controls). Additionally, integrate the CAPs with the OCFO's plan for OMB A-123 
implementation and annual FMFIA assurance statement. Management's plan for validation of 
corrective actions should be closely integrated with their controls test work conducted to 
comply with OMB A-123. 



OCFO - Financial Reporting 

We recommend that management: 

5. Identify a list of detailed tasks and critical milestones in the CAP to identify the root causes of 
the material weakness. When the OCFO completes its identification of the underlying root 
cause of the financial reporting weakness, including management's response to the conditions 
noted in the FY 2005 independent auditors' report, management should develop and implement 
CAPs that include specific milestones and assignment of tasks and oversight to appropriate 
individuals. 

6. Amend the CAP to include only root cause investigation, or corrective actions, designed to 
mitigate or eliminate the financial reporting material weakness. Ordinary, routine, 
responsibilities of the OCFO, such as "compiling September 30 financial statements", should be 
removed as they are not corrective actions developed in response to a root cause analysis. 

7. Include procedures in the CAP to assess the reasonableness of the time to develop, approve and 
issue appropriate corrective actions regarding policies and procedures. This recommendation 
may be dependent on the outcome of improvements to the control environment, discussed 
previously. 

8. Coordinate the development and implementation of the CAP tasks with the corrective actions 
from the other Department components and with the Department's OMB Circular A-123 
implementation. 



9. Assign the implementation of the financial reporting CAP to a manager who is principally 
responsible and accountable for fulfillment of the CAP. Presently, the tasks are split between 
managers who may not have sufficient time to commit to the project, and are delegating most of 
the tasks. Management should clearly define and track accountability. In addition, a senior 
executive should routinely monitor and manage the progress on the financial reporting CAP. 

10. Define the exact criteria which will be used to ascertain when the corrective action has been 
successfully completed, as well as the method for testing against such criteria as part of OMB 
A- 123 implementation steps (i.e. tests of design and tests of operating effectiveness of internal 
controls). Additionally, integrate the CAPs with the OCFO's plan for OMB A-123 
implementation and annual FMFIA assurance statement. Management's plan for validation of 
corrective actions should be closely integrated with their controls test work conducted to 
comply with OMB A-123. 



United States Coast Guard (Coast Guard) 

The Coast Guard has drafted CAPs intended to address its respective sections of the four material 
weaknesses on Financial Management Oversight, Financial Reporting, Fund Balance with Treasury, 
and Actuarial Liabilities, reported in the FY 2005 independent auditors' report. 

Background: 

The CAPs contain a description of the known issues and root causes, management's key success 
factors and performance measures, general resources required, and in some cases, time milestones 
for corrective actions. It is acknowledged that the Coast Guard has attended a CAP workshop 
sponsored by the OCFO on June 26, 2006, where the CAP approach, future actions and milestones 
were discussed. Additionally, the Coast Guard was instrumental in assisting the Department in the 
ePMO pilot implementation. 

Identification: 

The CAPs for the four material weaknesses consist primarily of known conditions, previously 
identified by the financial statement auditors, and lack evidence of a detailed review to identify the 
underlying root cause of the four material weaknesses. 

In order to develop a meaningful actionable CAP that includes identification of resource needs, 
milestones, performance indicators and accountability, the root cause(s) of the issue must be 
determined. As written, the CAPs do not extend beyond a general discussion of the problems or 
approach to correction, and the underlying causes of the conditions are not described in sufficient 
detail to allow development of specific actions and milestones. For example, the Coast Guard cites a 
lack of investment in personnel/training as a root cause in the Financial Management Oversight 
CAP. However, the CAP does not contain any further analysis of personnel deficiencies - such as 
which positions, roles and responsibilities, processes, locations, number of personnel, etc. 
Consequently, the associated action plan is limited to a general statement that "adequate personnel 
and financial resources must be made available in order to address root-cause issues and help ensure 
long-term sustainable success." 

The causes that have been identified have not been categorized, cross-referenced to problems 
identified by management, and prioritized for correction. In addition, the CAPs lack specific 
identification of financial systems and processes that require corrective actions, and an approach to 
correction. 



Likewise, the key success factors and performance measures identified consist primarily of an array 
of policies and procedures typically found in a reliable financial reporting process, without specific 
application to the Coast Guard financial reporting systems and processes. In some cases, possible 
corrective actions have been deferred, pending further review to identify issues and develop a full 
CAP at a future date. For example, the Financial Management Oversight CAP contains a critical 
milestone of "not later than February 15, 2007, issue report from the financial management 
transformation team containing a comprehensive, integrated plan and milestones..." The CAP is a 
plan to develop a plan, and is, therefore, incomplete, and would be ineffective without further 
development. 

The CAPs focus almost exclusively on audit finding recommendations categorized by material 
weakness in outline format with columns displaying status, percent complete, due date and 
individuals responsible for action. However, the reports do not contain a rationale for the due date, 
the detail steps planned or executed or how percentage of completion was determined or tested. 
The CAPs are incomplete as they only include audit recommendations which are only a small 
fraction of the total number of issues or root causes that Coast Guard must identify and address. The 
high level root causes identified in the CAPs appear to be the initial steps in that effort. 

In addition, the CAPs contain errors. For example, the resources required to correct Fund Balance 
with Treasury and Financial Reporting material weaknesses are identical, and the auditor 
recommendations in the CAP do not match the auditors' recommendation in the FY 2005 
independent auditors' report. 

Development and Accountability: 

Financial Management Oversight 

Management has identified four broad categories of issues that cause the Financial Management 
Oversight material weakness; (1) personnel / training, (2) organization, (3) [financial] systems, and 
(4) [personnel and budget] resources. The CAP, as written, is evidence that management recognizes 
the deep-rooted structural (organization, personnel and system) issues, and that full correction is a 
multi-year effort, and that a restructuring of the Coast Guard's financial management function may 
be needed to realign financial reporting processes with the optimal mix of civilian vs. military and 
centralized vs. decentralized responsibilities. In addition, the Coast Guard has vacant key financial 
positions. The Financial Management Oversight CAP, which is currently under review by the Coast 
Guard's interim CFO, calls for the creation of a "Financial Management Transformation Team," 
and for a "comprehensive, integrated plan of action and milestones..." by February 15, 2007. The 
Financial Management Oversight CAP is therefore incomplete, pending further development as 
planned by Coast Guard management. 

Financial Reporting 

The Financial Reporting CAP states that "There are many errors within the general ledger posting 
logic. Most of these are due to inherent systems' deficiencies..." However, it is not clear from the 
Financial Reporting CAP what steps will be taken to investigate these systems issues or when 
management expects to have the problem(s) resolved. In addition to financial systems problems, the 
Financial Reporting CAP identifies many fundamental / structural issues that are preventing the 
Coast Guard from preparing reliable financial data for submission to the OCFO, e.g., lack of 
policies, procedures, controls, personnel, training, inefficient and error prone processes. The 
Financial Reporting CAP lacks a detailed listing of tasks to investigate these fundamental issues, 
identify the root cause, and then develop corrective actions and assign responsibilities. Regarding 
resource requirements, management's assessment of the resources required to investigate and 
resolve these issues is limited to five staff (GS-12) personnel and unspecified funding for 



"modifications to the Core Accounting System". Yet full implementation of an auditor 
recommendation to "conduct an assessment of the current financial reporting process, including a 
review of the three general ledger systems..." will require the commitment of considerably more 
experienced supervisors, as well as expert systems personnel and/or contractors for identification 
and correction of posting logic problems. 

Fund Balance with Treasury 

Management has identified a number of issues that led to the material weakness in Fund Balance 
with Treasury accounts. Some issues appear to identify potential root causes, such as 
"cumbersome/complex systems and processes and poor process design and systems integration". 
However, most of the issues are symptomatic in nature, i.e., "inability to provide audit 
disbursement, collection, and adjustment populations, number of suspense transactions is excessive, 
missing some signed backup obligation documents," etc. The Fund Balance with Treasury CAP 
lacks evidence of a detailed investigation to identify the root cause and then to develop specific 
corrective actions. Further, the extent of IT system deficiencies that may be causing or contributing 
to the material weakness is not clear in the Fund Balance with Treasury CAP. Some steps could be 
taken immediately to improve the reliability of the Fund Balance with Treasury account balances. 
However, the Fund Balance with Treasury CAP lacks a separation of short and long term actions 
and a time-line for correction. 

Actuarial Liabilities 

The CAP includes a description of the underlying issues causing the material weakness in actuarial 
liabilities, and the majority of the issues appear to be potential root causes, e.g., 
multiple/inadequate/non-unified financial accounting systems, weak program oversight 
accountability, organizational structure, poor data integrity, etc. The due date for correction is 
December 2007. The Actuarial Liabilities CAP lacks interim milestones to make / measure 
incremental temporary improvements that will allow actuarial balances to be accurately stated in the 
financial statements in FY 2006. The resources required do not address the cost for system 
upgrades, reorganization, or process changes. For example, the Actuarial Liabilities CAP states that 
it lacks "input from CG-842 (FINCEN) and CG-841 (IT systems)" and is therefore not fully 
developed. 

Overall, the CAPs for each of the four material weaknesses lack important details necessary to be an 
effective plan. Specifically, we found that the Coast Guard CAPs lack: 

• Linkage or cross-reference to the material weakness conditions being corrected. Presently, the 
CAPs refer generally to the group of auditor findings by area, and it is difficult to determine if 
all of the conditions identified by the auditor are adequately addressed in the CAP; 

• Evidence of review and approval by management, together with a description of periodic 
progress reports to be provided to Coast Guard and OCFO management on progress; 

• A fully developed / detailed listing of the tasks to be performed, and identification of system 
deficiencies and corrective actions and who is accountable for their completion; 

• The detailed time-frame (milestones) that corrective actions are to occur, other than general 
months / years for a few actions, including the protocol of correction, e.g. systems before 
processes, etc.; 

• Performance metrics / measures for use by management to determine that corrective actions are 
on track or require modification, and to assign accountability; 



• A thorough evaluation of the resources needed - both personnel and funding, and the source of 
those resources once determined; 

• Identification and dedication of resources including supervisors and contract assistance. 
Presently, everyone associated with the CAP process already has other full-time job 
responsibilities within the Coast Guard. The corrective actions are of a scale that dedicated 
personnel, including management, are necessary for the plan to be effective in the near-term; 

• A description of how the Coast Guard will verify and validate that corrective actions are 
complete and effective in correcting the conditions that lead to material weaknesses; and 

• Integration with the Coast Guard's OMB A- 123 implementation process. 



Recommendations : 

We recommend that Coast Guard: 

11. Perform a thorough root cause analysis to identify the underlying causes of the four material 
weaknesses, including a review of financial IT systems, processes and human resources. Coast 
Guard should not rely on the financial statement audit to identify all of the significant causes of 
control weaknesses, and should only use the audit to corroborate management's findings. 

12. Develop CAPs to mitigate and ultimately correct control deficiencies, based on management's 
own assessment of the issues. The CAPs should include a description of the detailed tasks and 
milestones, key success and performance metrics, and a designated person who is primarily 
accountable for completion of the effort. The identified root causes should be cross-referenced 
to the weakness identified by management (as well as those identified by the financial statement 
auditor). The CAPs should be prioritized for correction, to minimize duplication of effort where 
corrective actions overlap (i.e., correction of IT system posting logic errors may resolve 
multiple issues, or mitigate the need for process changes). 

13. Make a realistic assessment of the resource requirements, i.e., human and financial, needed to 
perform the investigations to identify the root causes of material weaknesses, develop and 
execute thorough CAPs, and then to verify correction. This assessment should include input 
from all affected areas, i.e., CG-842 (FINCEN) and CG-841 (IT systems). In filling key 
financial management vacancies, the Coast Guard should ensure that the position holders have 
the necessary skills and experience to successfully execute the CAPs. 

14. Obtain support from executive leadership, since effective correction will at times compete with 
other mission priorities, and progress could falter without continuous reinforcement from 
leadership. 

15. Define the exact criteria which will be used to ascertain when the corrective action has been 
successfully completed, as well as the method for testing against such criteria as part of OMB 
A- 123 implementation steps (i.e. tests of design and tests of operating effectiveness of internal 
controls). Additionally, integrate the CAPs with the Coast Guard's plan for OMB A- 123 
implementation and annual FMFIA assurance statement. Management's plan for validation of 
corrective actions should be closely integrated with their controls test work conducted to comply 
with OMB A- 123. 



Immigration and Customs Enforcement (ICE) 



ICE has drafted CAPs intended to address their sections of the three material weaknesses on 
Financial Management Oversight, Financial Reporting, and Fund Balance with Treasury, reported 
in the FY 2005 independent auditors' report. 

Background: 

ICE established the Program Management Office (PMO), which reports to ICE's CFO, to develop 
and implement a three-year Financial Action Plan (FAP) to manage and monitor efforts to improve 
ICE's financial management. The FAP addresses the material weaknesses as they relate to ICE 
which includes the material weaknesses in Financial Management Oversight, Financial Reporting 
and Fund Balance with Treasury. 

In the establishment of the PMO, ICE contracted with a consulting firm to not only provide 
expertise but also manpower. The primary responsibilities of the PMO are to (1) provide program 
management infrastructure to ensure successful FAP execution, (2) provide guidance and support to 
staff developing initiative project plans and implementing them, and (3) resolve issues and mitigate 
risks that may hinder the FAP implementation effort. By February 2006, ICE issued its FAP and the 
process of implementing the corrective actions was launched. Each initiative in the FAP is 
supported by a Detailed Project Plan that outlines the tasks and milestones to be achieved. 

When the Department initiated its Department-wide CAP process in April 2006, ICE was already in 
the midst of its FAP implementation. In order to comply with the Department's CAP process, ICE 
fashioned its CAPs based on the information in its existing FAP. These CAPs summarizing the FAP 
initiatives were provided to the Department for uploading to the Department's ePMO database. 
While the CAPs and the FAP are similar, the FAP contains information regarding ICE's corrective 
actions in much greater detail than the summary-level information provided in the CAPs. For 
purposes of this performance audit, KPMG evaluated the corrective actions as detailed in ICE's 
FAP and supporting documentation. However, the FAP data was also compared with the 
information in ICE's CAPs within ePMO for consistency purposes. 

The FAP includes an analysis of root cause issues, potential effects of the deficiency, corrective 
actions and their foreseen impact. In addition, management has developed a timetable for corrective 
actions, and assigned specific tasks with due dates to specific individuals. 

When developing the FAP, ICE management indicated that it considered the FAP to be an 
evolutionary document that would be periodically updated as needed to consider new facts and 
circumstances, and to ensure continuous progress is made. Further, a decision was made to focus on 
deploying ICE's resources on the area of Fund Balance with Treasury with the goal of resolving this 
material weakness in FY 2006. Management decided that this measured, focused approach was the 
best way to fully rectify the issue, as opposed to attempting to work on all deficiencies 
simultaneously and spreading its resources too thin. While ICE wants to see positive progress in the 
remediation for each of the material weaknesses, it has only committed to fully remediate the Fund 
Balance with Treasury material weakness during FY 2006. 

The leadership provided by the ICE CFO in setting a positive 'tone-at-the-top,' and actively 
monitoring ICE's progress in implementing the FAP has shown to be integral to the success 
achieved at ICE thus far. The ICE's CFO continued commitment to the FAP effort is instrumental 
to resolving the material weaknesses at ICE. 



Financial Management Oversight 
Identification: 

Management has segregated the Financial Management Oversight material weakness into three 
primary areas: Workforce Strategy, Financial Systems, and Management Oversight. When 
developing the FAP, the PMO performed a root cause analysis which consisted primarily of 
conducting interviews with personnel and leveraging institutional knowledge of the ICE personnel 
in the PMO. The root cause analysis initially focused on the conditions cited by the auditors during 
the FY 2005 audit. The PMO categorized Financial Management Oversight within the FAP into 
two primary areas: Workforce Strategy and Financial Systems. Subsequent to the development of 
the FAP, the PMO expanded its initial root cause analysis which resulted in Management Oversight 
also being identified as one of three primary areas. To ensure that the FAP, at a minimum, 
addressed each of the auditor findings cited during the FY 2005 audit, the FAP contains an 
appendix which crosswalks each of the auditor findings to the task within each initiative designed to 
correct the material weakness. Additionally, as the work progresses, management may identify 
additional root causes and will update accordingly. 

Development: 

ICE developed and documented its corrective actions in a two-tiered approach. The first tier is the 
FAP itself which is at the highest level and can be described as more of a summary level. Each 
initiative within the FAP contains a brief background section as well as the following sections: 
Cause, Effect, Corrective Actions, and Impact of Corrective Actions. Within the Corrective Actions 
section, the primary tasks to be completed are listed along with a task description, milestone, and 
estimated date of completion (month and year). The second tier is the Detailed Project Plan which is 
at a more detailed level. The Detailed Project Plan contains the following sections: Project 
Summary, Key Team Roles and Responsibilities, Business Issues and Challenges, Project Plan, and 
Key Outputs. Within the Key Outputs section, the primary tasks to be completed are listed along 
with the key output description and the estimated date of completion (month, day, and year). 

The Project Plan, maintained in Microsoft Project, lists the primary tasks and the subtasks along 
with the number of days the tasklsubtask should take to complete as well as the start date and the 
end date for the task/subtask. The intent is that the FAP would be a static document while the 
Detailed Project Plan and the accompanying Microsoft Project Plan would be updated as needed. 
The information contained in the Corrective Action section of the FAP should be consistent with the 
information in the Key Outputs section of the Detailed Project Plan which, in turn, should be 
consistent with the Critical Milestones in the CAP within ePMO. 

Upon comparison of the tasks/critical milestones and the corresponding due dates in the FAP, dated 
February 2006; the Detailed Project Plan for Workforce Strategy and the Detailed Project Plan 
Financial Systems, dated May 31, 2006 and April 18, 2006, respectively; and the CAP Detail 
Report as of May 31, 2006 from ePMO; we noted a couple of minor inconsistencies (i.e., due dates, 
description of tasks, and number of tasks) between the various documents. In addition, we noted 
that the CAP within ePMO did not contain information on the Key Performance Measures, Risks 
and Impediments, and Resources Required. All of the inconsistencies between the various 
documents appear to be attributable to timing (i.e., the date each of the documents was prepared and 
the frequency with which ePMO was updated). 

ICE attended the Department's OCFO-sponsored CAP Workshop for Financial Management 
Oversight where the corrective action approach, future actions and milestones were discussed. ICE 
represented that the CAP Workshop was beneficial and provided ideas for revisions to its FAP. We 
understand that revised CAPs are due to the Department by July 12, 2006. These CAPs are outside 



the scope of this performance audit. ICE further represented that the revisions would not be 
considered significant but would be adding specificity to the existing data (e.g., tasks and 
milestones) and revising expected completion dates for select milestones, as well as providing 
information for the sections of the CAP which were not previously submitted for input into ePMO. 

Within the Management Oversight area, none of the tasks/critical milestones, with the exception of 
the task to "Establish Financial Action Plan Program Management Office", is considered to have a 
'true' completion date as the tasks are considered to be on-going. Other tasks lack exact criteria 
which will be used to ascertain when the corrective action has been successfully completed, as well 
as the method for testing against such criteria. Similarly, within Workforce Strategy, the PMO 
represented that the success criteria and validation criteria cannot be determined until the Workforce 
Transition Plan has been developed and implemented. 

The PMO has established a FAP Executive Dashboard which is updated at least monthly to provide 
a snapshot of the progress and status of each FAP Initiative. For each task/critical milestone within 
each FAP Initiative, a color coding is used to identify whether the task is complete (blue), on track 
(green), moderately delayed (yellow), significantly delayed (red) or not started (white). The FAP 
Dashboard does not reflect and track the progress for the area of Management Oversight and most 
of the tasks in this area are all considered to be on-going tasks as only one of the tasks/critical 
milestones in this area has a 'true' completion date. 

Of the ten and six tasks/critical milestones within the areas of Workforce Strategy and Financial 
Systems, respectively, ICE indicated in its FAP Dashboard as of June 30, 2006, that five and one, 
respectively, have been completed. 

Accountability: 

As previously mentioned, the PMO has established a FAP Executive Dashboard, which is updated 
at least monthly and provides a snapshot of the progress and status of each FAP Initiative. 
Additionally, the percentage of completion is presented at the overall FAP Initiative level. 

For each material weakness initiative included in the FAP, an ICE initiative owner has been 
assigned, as well as a PMO liaison. Additionally, ICE senior leadership also has a role in the FAP 
initiative. 

The PMO, in conjunction with the initiative owner, completed a resource template for each FAP 
Initiative which identified the resource name, skill set needed by the resource, and the number of 
hours per week by month for each resource. The resources were categorized as Executive Sponsor, 
Initiative Owner, or Staff. We noted that the resource template included both ICE employees and 
contracted personnel. 

As represented to us by the PMO, the responsibility for reporting on the task status and 
documenting evidence to support such status rests with the ICE initiative owner and not the PMO. 
However, we were informed that the PMO is in the process of gathering such evidence for 
completed tasks from each of the ICE initiative owners for its own records. 



Financial Reporting 
Identification: 

When developing the FAP, the PMO performed a root cause analysis which consisted primarily of 
conducting interviews with personnel and leveraging the institutional knowledge of the ICE 
personnel in the PMO. The root cause analysis initially focused on the conditions cited by the 
auditors during the FY 2005 audit. The analysis performed by the PMO team resulted in two 



categories being identified: Lack of Policies and Process Needs Improvement. To ensure that the 
FAP, at a minimum, addressed each of the auditor findings cited during the FY 2005 audit, the FAP 
contains an appendix which crosswalks each of the auditor findings to the task within each initiative 
designed to correct the material weakness. Subsequent to the development of the FAP, the PMO 
expanded its initial root cause analysis which resulted in additional causes being identified. 

Development: 

As previously discussed under the corresponding section under Financial Management Oversight, 
ICE developed and documented its corrective actions in a two-tiered approach. 

Upon comparison of the tasks/critical milestones and the corresponding due dates in the FAP, dated 
February 2006, the Detailed Project Plan dated June 15, 2006, and the CAP Detail Report as of May 
31, 2006 from ePMO, we noted a couple of minor inconsistencies (i.e., due dates, description of 
tasks, and number of tasks) between the various documents. In addition, we noted that the CAP 
within ePMO did not contain information on Key Performance Measures, Risks and Impediments, 
and Resources Required. Furthermore, all of the inconsistencies between the various documents 
appear to be attributable to timing (i.e., the date each of the documents was prepared and the 
frequency with which ePMO was updated). 

We understand that revised CAPs as of June 30, 2006, are due to the Department by July 12, 2006. 
ICE represented that it would be submitting a revised CAP to the Department. These revised CAPs 
are outside the scope of this performance audit. ICE further represented that the revisions would not 
be considered significant but would be adding specificity to the existing data (i.e., tasks and 
milestones) and revising expected completion dates for select milestones, as well as providing 
information in the sections of the CAP that were not previously submitted for input into ePMO. 

Abnormal balances, 'free-form' general journal entries, and accurate and timely submission of 
financial reports are considered to be significant problem areas within Financial Reporting. 
Although the PMO developed a metric to track and monitor the total amount and number of 
abnormal balances over $1 million, as well as the categorization (i.e., researched transactions 
causing abnormal balances, identified root cause, and identified data/process owner) of the amount 
and number of these abnormal balances, we noted no such similar metric to monitor and track the 
volume and reason of 'free-form' general journal entries. As such, it would appear that ICE w-ill be 
relying on the occurrence of high-level (i.e., branch director) approval of 'free-form' general 
entries, as required by the newly developed standard operating procedures, to test the success in this 
area. Further, we noted no mechanism to track and monitor the volume and type of 'warning' errors 
received upon submission of the monthly financial data into TIER. As such, it would appear that 
ICE will be relying only on the fact that the monthly financial data is submitted to the Department 
by its stipulated deadlines and that the financial data is accepted and processed in TIER without 
'fatal' errors. 

Of the eight tasks/critical milestones within Financial Reporting ICE indicated it its FAP Dashboard 
as of June 30,2006, three tasks/critical milestones have been completed. 

Based on the progress being made on the task related to the research and resolution of abnormal 
balances, ICE updated the Detailed Project Plan for Financial Reporting on June 1 5 ,2006 which 
extended the estimated completion dates for this task. 

Lastly, ICE is scheduled to attend the Department's OCFO- sponsored CAP Workshop for Financial 
Reporting on August 7,2006. 
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Accountability: 

Refer to the corresponding section under Financial Management Oversight for a discussion of the 
roles of personnel with ICE, the completion of resource templates, the responsibility for supporting 
the progress made and the reporting of corrective action status via the FAP Dashboard. 

Fund Balance with Treasury (FBWT) 
Identification: 

When developing the FAP, the PMO performed a root cause analysis which consisted primarily of 
conducting interviews with personnel and leveraging the institutional knowledge of the ICE 
personnel in the PMO. The root cause analysis initially focused on the conditions cited by the 
auditors during the FY 2005 audit. The analysis performed by the PMO team resulted in three 
categories being identified: Untimely Clearing and Recording of Items, Lack of Policies, and 
Process Needs Improvement. The PMO categorized Fund Balance with Treasury within the FAP 
into four primary areas as follows: 

• Cash Reconciliation 

• Statement of Differences 

• Suspense 

• Non-224 Transactions 

To ensure that the FAP, at a minimum, addressed each of the auditor findings cited during the FY 
2005 audit, the FAP contains an appendix which crosswalks each of the auditor findings to the task 
within each initiative designed to correct the material weakness. Subsequent to the development of 
the FAP, the PMO expanded its initial root cause analysis which resulted in additional causes being 
identified. Additionally, as the work progresses management may identify additional root causes 
and will update accordingly. 

Development: 

As previously discussed under the corresponding section under Financial Management Oversight, 
ICE developed and documented its corrective actions in a two-tiered approach. 

Upon comparison of the tasks/critical milestones and the corresponding due dates in the FAP, dated 
February 2006, the Detailed Project Plan dated April 4, 2006, and the CAP Detail Report as of May 
31, 2006 from ePMO, we noted a couple of minor inconsistencies (i.e., due dates, description of 
tasks, and number of tasks) between the various documents. In addition, we noted that the CAP 
within ePMO did not contain information on Key Performance Measures, Risks and Impediments, 
and Resources Required. Furthermore, all of the inconsistencies between the various documents 
appear to be attributable to timing (i.e., the date each of the documents was prepared and the 
frequency with which ePMO was updated). 

We understand that revised CAPs as of June 30, 2006, are due to the Department by July 12, 2006. 
ICE represented that it would be submitting a revised CAP to the Department. These revised CAPs 
are outside the scope of this performance audit. ICE further represented that the revisions would not 
be considered significant but would be adding specificity to the existing data (i.e., tasks and 
milestones) and revising expected completion dates for select milestones, as well as providing 
information in the sections of the CAP that were not previously submitted for input into ePMO. 



Standard operating procedures were issued for each of the identified four areas. In addition, within 
the areas of Statement of Differences and Suspense, the tasks reflected as complete include the 
reconciling and clearing of all FY 2005 transactions and FY 2006 transactions greater than 60 days 
for both ICE and each of the Components. 

ICE is scheduled to attend the Department's OCFO- sponsored CAP Workshop for Fund Balance 
with Treasury on August 16,2006. 

Accountability: 

Refer to the corresponding section under Financial Management Oversight for a discussion of the 
roles of personnel with ICE, the completion of resource templates, the responsibility for supporting 
the progress made and the reporting of corrective action status via the FAP Dashboard. 

Recommendations : 

We recommend that ICE: 

16. Ensure that revisions and updates to the FAP and supporting documentation are made to ICE's 
CAPs maintained in ePMO. Since the CAPs maintained in ePMO are the basis for the 
Department-wide CAP and ePMO is the system of record for the Department for corrective 
actions, it is imperative that the CAP data in ePMO be current. 

17. Within the area of Management Oversight, define the exact criteria which will be used to 
ascertain when the corrective action has been successfully completed, as well as the method for 
testing against such criteria as part of OMB A- 123 implementation steps (i.e. tests of design and 
tests of operating effectiveness of internal controls). Additionally, integrate the CAPs with 
ICE's plan for OMB A- 123 implementation and annual FMFIA assurance statement. 
Management's plan for validation of corrective actions should be closely integrated with their 
controls test work conducted to comply with OMB A- 123. 

18. Include completion of the GAO Evaluation Tool as a critical milestone in its Financial 
Reporting CAP. 

19. Within the area of Workforce Strategy, define the success and validation criteria in conjunction 
with the development and implementation of the Workforce Transition Plan. 

20. Enhance its understanding and working knowledge of ePMO to ensure that ICE's CAP data in 
ePMO is portraying an accurate picture. As previously stated, the CAPs maintained in ePMO 
are the basis for the Department- wide CAP and ePMO is the system of record for the 
Department for corrective actions. 

21. Reduce the volume of 'free-form' general journal entries that are recurring in nature. This would 
reduce the need for the entry to be made as a 'free-form' general journal entry which in turn 
would reduce the risk of an inappropriate entry being recorded. 

22. Develop a mechanism to track and monitor the volume and type of 'warning' errors received 
upon submission of the monthly financial data into TIER. This would effectively limit the 
number of 'warning' errors received by being proactive in researching and resolving the 
underlying cause. 
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MEMORANDUM FOR: Richard L. Skinner, Inspector General 

FROM: David L. Norquist, Chief Financial Officii/ 



SUBJECT: 



Audit of DHS' Corrective Action Plan Process for Financial 
Reporting - Report No. 2 



Thank you for the opportunity to comment upon the Audit of DHS' Corrective Action Plan 
Process for Financial Reporting - Report No. 2. We concur with the report's recommendations 
and are pleased to report that actions are already underway to address the issues raised in the 
report. The report highlights valuable best practices and lessons learned. For example, ICE is 
improving the internal control environment through establishing a strong "tone at the top" and 
Coast Guard is piloting an automated corrective action planning tracking system for managing 
Department-wide corrective action plans (CAPs). Most significantly, throughout the summer the 
Department sponsored a series of CAP workshops designed to help identify crosscutting root 
causes of internal control deficiencies focusing on the areas of people, policies, processes, and 
systems. The workshops set clear expectations for integrating test of design and operating 
effectiveness requirements of DHS policy and OMB Circular No. A- 123, Management's 
Responsibility for Internal Controls into our corrective action plans. The workshops were well 
attended and supported by all DHS Components and we are developing stronger corrective 
actions as a result. 

After the CAPs are updated, the next step will be the implementation of the DHS Internal 
Controls over Financial Reporting (ICOFR) Playbook. The ICOFR Playbook will act as a 
single, comprehensive, and integrated plan to organize and focus corrective action and 
assessment efforts across the Department. 

We appreciate the positive comments about our developing corrective action planning process. 
In closing, we look forward to continue our partnership in implementing corrective actions and 
most importantly the DHS Financial Accountability Act. 
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